56b64c98e28bab8073367d42b39661e19cc99f425785a52d8230741b1b796772 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:44

Sharing

Report Analysis Logs

General

Target

11b3d63ef0c6b52968567db522890fee.exe
Size

28KB
MD5

11b3d63ef0c6b52968567db522890fee
SHA1

1b368492c37f1bfeaaa168054df9794bfb565987
SHA256

56b64c98e28bab8073367d42b39661e19cc99f425785a52d8230741b1b796772
SHA512

7527a43fe6972d0abe4ac6786606b4ed3c67562450309b3b13ad270e3e93ce73de7afc99814946759c57a389ed80171bef8727cab296099c60a0bdad167967c0
SSDEEP

384:k/cEuOktb0ADn6nIohGr1G+cJINEf11e4Cp3j2J:acDH2nIoIrotMj2J

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1988	11b3d63ef0c6b52968567db522890fee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	11b3d63ef0c6b52968567db522890fee.exe

C:\Users\Admin\AppData\Local\Temp\11b3d63ef0c6b52968567db522890fee.exe
"C:\Users\Admin\AppData\Local\Temp\11b3d63ef0c6b52968567db522890fee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000000030000-0x0000000000032000-memory.dmp

Filesize
8KB

Download
memory/1988-1-0x0000000000030000-0x0000000000032000-memory.dmp

Filesize
8KB

Download